svelte-realtime 0.4.11 → 0.4.13

package/README.md

@@ -634,9 +634,9 @@ Call live functions from `+page.server.js` to load data server-side, then hydrat
 
 ```js
 // src/routes/chat/+page.server.js
-export async function load({ platform }) {
+export async function load({ platform, locals }) {
   const { messages } = await import('$live/chat');
-  const data = await messages.load(platform);
+  const data = await messages.load(platform, { user: locals.user });
   return { messages: data };
 }
 ```
@@ -884,14 +884,47 @@ Call `configure()` once at app startup. The hooks fire on state transitions only
 When using svelte-realtime from a client that runs on a different origin (Svelte Native, React Native, or any standalone app), pass the `url` option to point at your SvelteKit backend:
 
 ```js
-import { configure } from 'svelte-realtime/client';
+import { configure, __rpc, __stream } from 'svelte-realtime/client';
 
-configure({
-  url: 'wss://my-sveltekit-app.com/ws'
-});
+configure({ url: 'wss://my-sveltekit-app.com/ws' });
+
+// Call a live function (equivalent to $live/chat.sendMessage, but untyped)
+const sendMessage = __rpc('chat/sendMessage');
+await sendMessage('hello');
+
+// Subscribe to a stream (returns a Svelte store)
+const messages = __stream('chat/messages', { merge: 'crud', key: 'id' });
+messages.subscribe((value) => console.log(value));
+```
+
+The typed `$live/*` imports and stream hydration are generated by the Vite plugin and only work inside a SvelteKit project. Outside SvelteKit, use `__rpc()` and `__stream()` directly. You get the same reconnection, offline queue, and batching -- just without codegen and types.
+
+When `url` is set, the default same-origin WebSocket URL is bypassed entirely. Requires `svelte-adapter-uws` 0.4.8+.
+
+Browser clients authenticate via cookies set during login. Native clients typically use a token instead. Your upgrade hook can support both:
+
+```js
+// src/hooks.ws.js
+export { message } from 'svelte-realtime/server';
+
+export function upgrade({ cookies, url }) {
+  // Browser -- cookie auth
+  const session = cookies.session_id;
+  if (session) return validateSession(session);
+
+  // Native app -- token auth via query string
+  const token = new URL(url, 'http://n').searchParams.get('token');
+  if (token) return validateToken(token);
+
+  return false;
+}
 ```
 
-When `url` is set, the default same-origin WebSocket URL is bypassed entirely. All RPC calls, streams, and pub/sub work the same way. Requires `svelte-adapter-uws` 0.4.8+.
+The native client passes the token in the URL:
+
+```js
+configure({ url: 'wss://my-sveltekit-app.com/ws?token=...' });
+```
 
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "svelte-realtime",
-  "version": "0.4.11",
+  "version": "0.4.13",
   "description": "Realtime RPC and reactive subscriptions for SvelteKit, built on svelte-adapter-uws",
   "author": "Kevin Radziszewski",
   "license": "MIT",

package/server.js

@@ -1,7 +1,7 @@
 // @ts-check
 
 const textDecoder = new TextDecoder();
-const _validPathRe = /^[a-zA-Z0-9_]+(?:\/[a-zA-Z0-9_]+)+$/;
+const _validPathRe = /^[a-zA-Z0-9_-]+(?:\/[a-zA-Z0-9_-]+)+$/;
 const _validSegmentRe = /^[a-zA-Z0-9_]+$/;
 
 /** @type {Map<string, Function>} */
@@ -13,6 +13,9 @@ const guards = new Map();
 /** @type {Set<Function>} Streams with onUnsubscribe hooks (for iterating static matches in close) */
 const _streamsWithUnsubscribe = new Set();
 
+/** @type {Set<string>} Paths that already warned about null ctx.user in __directCall */
+const _directCallWarned = new Set();
+
 /**
  * Tag a topic function with __topicUsesCtx by inspecting its first parameter name.
  *
@@ -2472,7 +2475,13 @@ export async function __directCall(path, args, platform, options) {
 	// Run module guard
 	const modulePath = /** @type {any} */ (fn).__modulePath || path.substring(0, path.lastIndexOf('/'));
 	const guardFn = await _resolveGuard(modulePath);
-	if (guardFn) await guardFn(ctx);
+	if (guardFn) {
+		if (ctx.user === null && typeof process !== 'undefined' && process.env?.NODE_ENV !== 'production' && !_directCallWarned.has(path)) {
+			_directCallWarned.add(path);
+			console.warn(`[svelte-realtime] .load() is calling guard for '${path}' with ctx.user = null. Pass { user } in the options to provide user data:\n  stream.load(platform, { user: locals.user })\n  See: https://svti.me/ssr`);
+		}
+		await guardFn(ctx);
+	}
 
 	if (/** @type {any} */ (fn).__isStream) {
 		if (/** @type {any} */ (fn).__isGated) {

package/vite.js

@@ -1604,7 +1604,7 @@ function _generateTypeDeclarations(liveDir, dir) {
 			if (isTS) {
 				const returnType = _extractStreamReturnType(source, name);
 				const storeType = `StreamStore<${returnType} | undefined | { error: RpcError }>`;
-				const loadSig = `{ load(platform: any, options?: { args?: any[] }): Promise<${returnType}> }`;
+				const loadSig = `{ load(platform: any, options?: { args?: any[]; user?: any }): Promise<${returnType}> }`;
 				if (isDynamic) {
 					const factoryParams = _extractDynamicFactoryParams(source, name, 'live\\.stream');
 					exports.push(`  export const ${name}: (${factoryParams} => ${storeType}) & ${loadSig};`);
@@ -1612,7 +1612,7 @@ function _generateTypeDeclarations(liveDir, dir) {
 					exports.push(`  export const ${name}: ${storeType} & ${loadSig};`);
 				}
 			} else {
-				const loadSig = `{ load(platform: any, options?: { args?: any[] }): Promise<any> }`;
+				const loadSig = `{ load(platform: any, options?: { args?: any[]; user?: any }): Promise<any> }`;
 				if (isDynamic) {
 					exports.push(`  export const ${name}: ((...args: any[]) => StreamStore<any>) & ${loadSig};`);
 				} else {
@@ -1629,7 +1629,7 @@ function _generateTypeDeclarations(liveDir, dir) {
 			if (!exports.some(e => e.includes(`export const ${name}:`))) {
 				needsStreamStore = true;
 				const isDynamic = _isDynamicExport(source, name, 'live\\.channel');
-				const loadSig = `{ load(platform: any, options?: { args?: any[] }): Promise<any> }`;
+				const loadSig = `{ load(platform: any, options?: { args?: any[]; user?: any }): Promise<any> }`;
 				if (isDynamic) {
 					if (isTS) {
 						const factoryParams = _extractDynamicFactoryParams(source, name, 'live\\.channel');
@@ -1650,7 +1650,7 @@ function _generateTypeDeclarations(liveDir, dir) {
 			handledNames.add(name);
 			if (!exports.some(e => e.includes(`export const ${name}:`))) {
 				needsStreamStore = true;
-				exports.push(`  export const ${name}: StreamStore<any> & { load(platform: any, options?: { args?: any[] }): Promise<any> };`);
+				exports.push(`  export const ${name}: StreamStore<any> & { load(platform: any, options?: { args?: any[]; user?: any }): Promise<any> };`);
 			}
 		}
 
@@ -1661,7 +1661,7 @@ function _generateTypeDeclarations(liveDir, dir) {
 			handledNames.add(name);
 			if (!exports.some(e => e.includes(`export const ${name}:`))) {
 				needsStreamStore = true;
-				exports.push(`  export const ${name}: StreamStore<any> & { load(platform: any, options?: { args?: any[] }): Promise<any> };`);
+				exports.push(`  export const ${name}: StreamStore<any> & { load(platform: any, options?: { args?: any[]; user?: any }): Promise<any> };`);
 			}
 		}